---
phase: 25.2-doyle-cluster-fix-candidates
verified: 2026-05-22T00:00:00Z
status: passed
score: 5/5 fix candidates shipped; 12/12 LOCKED decisions honored
overrides_applied: 0
---

# Phase 25.2: Doyle Cluster Fix Candidates Verification Report

**Phase Goal:** Resolve 5 fix candidates (#1, #2, #3, #4, #5) from the 2026-05-22 doyle listener-poll diagnostic. #6 (haiku absorption) explicitly out of scope per CONTEXT specifics.
**Verified:** 2026-05-22
**Status:** passed
**Re-verification:** No — initial verification

## Goal Achievement

### Observable Truths

| # | Truth | Status | Evidence |
| --- | ---- | ------ | -------- |
| 1 | #1 Stale `index.lock` probe ships in `ensure_worktree` fast-path before `return Ok(wt)` | VERIFIED | `src/common/tracked.rs:365-407` — len==0 && mtime>60s conjunction, soft-fail with "(continuing)" WARNING. Test `ensure_worktree_removes_stale_index_lock` + `ensure_worktree_preserves_fresh_index_lock` pass. |
| 2 | #2 Ghost `tracked/.git/` cleanup ships in `migrate_legacy_if_needed` | VERIFIED | `src/common/tracked.rs:1524-1545` — unconditional best-effort `remove_dir_all`, single stat-syscall idempotency gate, soft-fail. |
| 3 | #3 wrapper-state read budget dilated from 8 to 80 attempts (20s) via shared helper | VERIFIED | `WRAPPER_STATE_MAX_ATTEMPTS: u32 = 80` at `src/common/wrapper_state.rs:206`; consumed by `read_wrapper_state_with_retry` (production helper) and `read_wrapper_state_with_retry_with_budget` (pub test form). Both boot (`start.rs:655`) + signoff (`signoff.rs:203`) call sites converted. Zero hits for `MAX_ATTEMPTS = 8` anywhere in `src/`. |
| 4 | #4 wrapper poll-sentinel resolved nested-first via `wrapper_state_path_resolved` + 8-site psyche-side swap | VERIFIED | Resolver at `src/common/wrapper_state.rs:142`. Psyche-side `ready_file_at` + `nested_perch_dir` confirmed at `wrapper/mod.rs:629-631, 705-706, 869-870`, `lifecycle.rs:107`, `echo_fire.rs:112`, `orphan.rs:243-244`. Form B reader at `lifecycle.rs:29` routes through resolver. Writer sites at `mod.rs:1116`, `claude.rs:175`, `lifecycle.rs:79` keep flat with migration-window comment blocks (per Q2 RESOLVED). |
| 5 | #5 `drain_stale_signoff_file` rewritten as deliver-then-die forwarding `<EVENT type="latent signoff">` envelope | VERIFIED | `src/live/start.rs:144-235` — inline envelope construction via `event_attr_escape`/`event_body_escape`; D-10 deliver gated on `delivered`; D-11 envelope shape verbatim; D-12 `debug_assert!` guard at L194-197. Integration test `drain_stale_signoff_file_forwards_latent_signoff_envelope` + `drain_stale_signoff_file_no_stop_loop_regression` + in-module D-12 unit test all pass. |

**Score:** 5/5 truths verified.

### LOCKED Decision Honor Check (D-01..D-12)

| # | Decision | Status | Evidence |
| --- | -------- | ------ | -------- |
| D-01 | 3 plans matching ROADMAP groups | VERIFIED | `25.2-01-PLAN.md` (#1+#3+#4), `25.2-02-PLAN.md` (#5), `25.2-03-PLAN.md` (#2) all present. |
| D-02 | Parallel waves, disjoint file overlap | VERIFIED | Plan 1+2 both touch `src/live/start.rs` but in disjoint functions (`emit_boot_trigger_after_spawn` vs `drain_stale_signoff_file`). |
| D-03 | Audit inline in each plan task 1 | VERIFIED | `25.2-01-AUDIT.md`, `25.2-02-AUDIT.md` present; Plan 3 audit captured in commit body per the conditional clause. |
| D-04 | Operator UAT + targeted integration tests | VERIFIED | 4 new integration test files: `native_tracked_stale_lock.rs` (2), `native_wrapper_state_retry.rs` (4), `native_wrapper_path_resolver.rs` (3), `native_latent_signoff_deliver_then_die.rs` (3). Operator UAT auto-approved per `workflow.auto_advance = true`. |
| D-05 | `MAX_ATTEMPTS` raised from 8 to 80 | VERIFIED | `pub const WRAPPER_STATE_MAX_ATTEMPTS: u32 = 80;` at `src/common/wrapper_state.rs:206`. |
| D-06 | Single shared const, all consumers route through helper, no drift | VERIFIED | Production consumers exist for boot (`start.rs:655`) + signoff (`signoff.rs:203`). The 5 D-06 sites in CONTEXT (boot/signoff/commune/pulse/init) collapse to 2 in production today — commune/pulse/init triggers do NOT have wrapper-state read sites in current code (Plan 1 SUMMARY documented this and `grep -nE "MAX_ATTEMPTS\\s*[:=]\\s*8\\b" src/ -r` returns **0 hits**, confirming drift impossible). |
| D-07 | On exhaustion: skip row + structured warning, no abort | VERIFIED | `read_wrapper_state_with_retry_with_budget` returns `None` on exhaustion; callers in `start.rs::emit_boot_trigger_after_spawn` and `signoff.rs::emit_signoff_trigger` log WARNING and continue. |
| D-08 | `wrapper-state read: <ms> (<site>)` log line | VERIFIED | `src/common/wrapper_state.rs:238` emits `"wrapper-state read: {}ms ({})"` on every successful read (no floor — Q3 RESOLVED). |
| D-09 | Latent-signoff forwarded as commune envelope, NOT INIT_SIGNOFF | VERIFIED | Envelope literal contains `type="latent signoff"` (with SPACE); zero occurrences of `init_signoff` substring in the envelope path (`init_signoff` mentions in start.rs are doc comments + the debug_assert guard, never in the envelope body itself). |
| D-10 | File deletion gated on transport Ok | VERIFIED | `src/live/start.rs:222-231` — `if delivered { fs::remove_file(...) }` after `catch_unwind` wraps `deliver_body_anonymous`. Panic path preserves file for next attempt. |
| D-11 | Envelope shape `<EVENT type="latent signoff" ...>` verbatim | VERIFIED | `src/live/start.rs:183` literal: `<EVENT type="latent signoff" from="{}" written_at="{}" cleared_from="{}">{}</EVENT>`. |
| D-12 | `is_init_signoff_envelope` returns false on latent-signoff envelope | VERIFIED | In-module test `latent_signoff_envelope_is_not_init_signoff_envelope` at `src/live/wrapper/mod.rs:2904` asserts predicate returns false. Test PASSES. Production also guards via `debug_assert!(!envelope.to_ascii_lowercase().contains("init_signoff"))` at `src/live/start.rs:194-197`. |

### Required Artifacts

| Artifact | Expected | Status | Details |
| -------- | -------- | ------ | ------- |
| `src/common/wrapper_state.rs` | `WRAPPER_STATE_MAX_ATTEMPTS = 80`, `wrapper_state_path_resolved`, retry helpers | VERIFIED | All 4 surfaces present (L142, L206, L225, L266). |
| `src/common/tracked.rs` | stale-lock probe in ensure_worktree + ghost cleanup in migrate_legacy_if_needed | VERIFIED | Stale-lock probe at L365-407; ghost cleanup at L1524-1545. |
| `src/live/start.rs` | drain_stale_signoff_file rewritten + emit_boot_trigger_after_spawn uses retry helper | VERIFIED | Drain rewrite at L144-235; boot trigger at L655 calls `read_wrapper_state_with_retry`. |
| `src/live/signoff.rs` | signoff-side retry helper consumption | VERIFIED | L203 calls `read_wrapper_state_with_retry` with `"signoff"` site label. |
| `src/live/wrapper/mod.rs` | nested swap + in-module D-12 test | VERIFIED | Nested swap at L630-631, 705-706, 869-870. D-12 test at L2904. |
| `src/live/wrapper/lifecycle.rs` | nested swap (Form B reader + Form C cleanup) | VERIFIED | Reader at L29 routes through `wrapper_state_path_resolved`; cleanup at L107 uses `nested_perch_dir`. |
| `src/live/wrapper/claude.rs` | writer stays flat with migration-window comment | VERIFIED | Comment block at L175 cites `wrapper_state_path_resolved`. |
| `src/live/wrapper/echo_fire.rs` | psyche-side .more-done sentinel swapped to nested | VERIFIED | L112 uses `nested_perch_dir`. |
| `src/live/wrapper/orphan.rs` | psyche-perch liveness pre-INIT_SIGNOFF swapped to nested | VERIFIED | L243-244 use `ready_file_at + nested_perch_dir`. |
| `tests/native_tracked_stale_lock.rs` | 2 tests | VERIFIED | 2/2 pass (0.66s). |
| `tests/native_wrapper_state_retry.rs` | 4 tests | VERIFIED | 4/4 pass (1.77s). |
| `tests/native_wrapper_path_resolver.rs` | 3 tests | VERIFIED | 3/3 pass (0.00s). |
| `tests/native_latent_signoff_deliver_then_die.rs` | 3 tests (A, B, D) | VERIFIED | 3/3 pass (9.19s). |

### Key Link Verification

| From | To | Via | Status | Details |
| ---- | -- | --- | ------ | ------- |
| `start.rs::emit_boot_trigger_after_spawn` | `wrapper_state` retry helper | `read_wrapper_state_with_retry(..., "boot")` | WIRED | L655. |
| `signoff.rs::emit_signoff_trigger` | `wrapper_state` retry helper | `read_wrapper_state_with_retry(..., "signoff")` | WIRED | L203. |
| `drain_stale_signoff_file` | `{id}-psyche` perch | `send::deliver_body_anonymous` (panic-safe via catch_unwind) | WIRED | `src/live/start.rs:206-209`. |
| `wrapper/{mod,lifecycle,echo_fire,orphan}.rs` psyche reads | nested perch dir | `nested_perch_dir(self_id, psyche_id)` | WIRED | 8 production call sites confirmed. |
| `is_init_signoff_envelope` | latent-signoff envelope | shape-disjoint predicate | VERIFIED DISJOINT | In-module test asserts predicate returns false. |
| `migrate_legacy_if_needed` | ghost `tracked/.git/` removal | `std::fs::remove_dir_all` (best-effort) | WIRED | `src/common/tracked.rs:1534`. |
| `ensure_worktree` fast-path | stale lock removal | `std::fs::remove_file` (best-effort) | WIRED | `src/common/tracked.rs:394`. |

### Behavioral Spot-Checks

| Behavior | Command | Result | Status |
| -------- | ------- | ------ | ------ |
| Release build green | `cargo build --release` | Finished `release` profile, 3 unrelated dead-code warnings | PASS |
| 4 new integration test files pass | `cargo test --release --test native_tracked_stale_lock --test native_wrapper_state_retry --test native_wrapper_path_resolver --test native_latent_signoff_deliver_then_die -- --test-threads=1` | 2+4+3+3 = 12/12 pass | PASS |
| In-module D-12 test passes | `cargo test --release --lib latent_signoff_envelope_is_not_init_signoff_envelope -- --test-threads=1` | 1/1 pass | PASS |
| Full release suite baseline matches SUMMARY | `cargo test --release -- --test-threads=1` | 770 pass, 1 fail (pre-existing `current_version_honors_override_in_debug_builds`), 5 ignored | PASS (matches documented baseline) |
| D-06 const drift impossible | `grep -nE "MAX_ATTEMPTS\s*[:=]\s*8\b" src/ -r` | 0 hits | PASS |
| Old surface removed | `grep -n "owl_pending_signoff" src/` | 0 hits | PASS |
| `wrapper-state read:` log present | `grep -nE "wrapper-state read:" src/` | 1 production hit (L238 wrapper_state.rs) + 2 doc references | PASS |
| Resolver defined + used | `grep -nE "wrapper_state_path_resolved" src/` | Defined at wrapper_state.rs:142; used at lifecycle.rs:29 + cited at claude.rs:175 + mod.rs:1116 + lifecycle.rs:79 in writer migration-window comment blocks | PASS |
| Latent signoff envelope literal present | `grep -nE 'type="latent signoff"' src/` | Hits in start.rs (envelope literal at L183, doc at L120, comment at L172) + mod.rs:2905 (test fixture) + 2894 (doc) | PASS |
| Phase 23-era ghost cleanup present | `grep -nE "Phase 23-era ghost|remove_dir_all" src/common/tracked.rs` | L1534 remove_dir_all + L1536 "Phase 23-era ghost" message | PASS |

### Anti-Patterns Found

| File | Line | Pattern | Severity | Impact |
| ---- | ---- | ------- | -------- | ------ |
| (none) | — | — | — | All modifications follow PATTERNS S-1 best-effort + structured WARNING idiom; no new TODO/FIXME/XXX markers; no empty implementations; no console.log-only handlers. |

### Region Discipline (Plan 1+2 overlap)

| File | Plan 1 region | Plan 2 region | Status |
| ---- | ------------- | ------------- | ------ |
| `src/live/start.rs` | `emit_boot_trigger_after_spawn` (L583+) | `drain_stale_signoff_file` (L144-235) | DISJOINT — no logical collision. |
| `src/live/wrapper/mod.rs` | Production routes (L629-870) | `is_init_signoff_envelope_tests` mod (L2888+) | DISJOINT — production vs test mod. |

### Deferred / Pre-existing

| Item | Status | Note |
| ---- | ------ | ---- |
| `owl::version_changelog::tests::current_version_honors_override_in_debug_builds` panics in `--release` mode | DEFERRED — pre-existing, not introduced by Phase 25.2 | Documented in 25.2-01 SUMMARY (confirmed pre-existing on HEAD~5). Test passes under default debug profile. Recommendation: add `#[cfg(debug_assertions)]` to the test fn in a future quick. |

### Human Verification Required

None. All claims are verifiable programmatically via grep + cargo build + cargo test. Operator UAT smoke (`$LIVE revive doyle` post-deploy; observe `LATENT-SIGNOFF-FORWARDED:doyle` + sessions-log seal + no warning regression) is auto-approved per `workflow.auto_advance = true` and is not a package-legitimacy gate.

### Gaps Summary

No gaps. All 5 fix candidates shipped at the documented code anchors. All 12 LOCKED decisions (D-01..D-12) honored with concrete code + test evidence. Build green; targeted tests 12/12 pass; in-module D-12 test passes; full-suite baseline 770/1/5 matches the documented Plan 1 / Plan 2 / Plan 3 SUMMARY claims (the single pre-existing release-mode failure is documented and predates this phase).

---

*Verified: 2026-05-22*
*Verifier: Claude (gsd-verifier)*